Google has initiated legal action against a China linked cybercrime network accused of using its Gemini artificial intelligence platform to support phishing operations targeting users in the United States through SMS based scams, commonly known as smishing. The company announced on Friday that the network allegedly weaponized Gemini to generate phishing websites and carry out large scale fraudulent text messaging campaigns impersonating legitimate brands and institutions. According to Google, victims received deceptive messages warning of brokerage account issues or claiming eligibility for mobile carrier rewards, encouraging them to click malicious links. Those links reportedly redirected users to fraudulent websites designed to closely resemble trusted organizations in an effort to steal financial details, login credentials, and personal information. Google said the legal action is intended to dismantle the cybercriminal infrastructure behind the operation and disrupt the network’s ability to continue targeting consumers.
The cybercrime operation is reportedly tied to a phishing as a service platform known as Outsider, which Google claims is managed and coordinated by a China based network through Telegram channels and automated systems. The phishing toolkit allegedly enables threat actors to launch convincing scams without advanced technical expertise by offering ready made templates and simplified deployment methods. According to Google, the service has contributed to attacks affecting more than 100,000 individuals, resulting in financial losses amounting to millions of dollars. Between November 14, 2025 and April 14, 2026, investigators reportedly identified approximately 9,000 fake websites and more than 1.59 million malicious URLs associated with Outsider activity. Google further stated that during a two week period from May 18 to June 1, 2026, Android users flagged around 55,000 spam messages linked to the operation, while approximately 2.5 million text messages containing phishing links connected to Outsider generated websites were delivered to Android users.
Google’s complaint, filed in Manhattan federal court, alleges that the operators behind Outsider used Gemini and other artificial intelligence tools by disguising requests as harmless programming assistance prompts. According to the filing, threat actors instructed AI systems to generate HTML code for fake promotional or reward redemption pages while specifying design requirements that helped mimic legitimate websites. The generated code was allegedly inserted into Outsider templates to create fraudulent pages used in phishing schemes. Google stated that for fees starting as low as $88 per week, cybercriminals could subscribe to the phishing service, create fraudulent websites, launch campaigns, and steal credit card details, banking information, and sensitive user data. The platform reportedly also includes more than 290 pre built website templates impersonating trusted institutions, real time keystroke logging capabilities, campaign performance tracking, and Telegram based ordering systems through a self service bot.
Investigators said the Outsider operation consists of interconnected groups responsible for separate aspects of the criminal ecosystem, including software development, target list generation, spam messaging distribution, financial theft, and operational coordination through Telegram. Google noted that services such as Outsider significantly reduce technical barriers for inexperienced fraudsters by providing accessible tools capable of launching large scale phishing attacks with minimal effort. Brett Leatherman, Assistant Director of FBI Cyber Division, stated that cybercriminals are increasingly relying on artificial intelligence to make online fraud more convincing and difficult to detect. The latest legal action comes seven months after Google pursued another lawsuit against a China linked phishing as a service platform known as Lighthouse, which allegedly impacted more than one million users across 120 countries
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
